Customer No.: 00909 
Application Serial No. 09/886,611 
Attorney Docket No. 019287/0317326 

Please replace all prior versions and listings of claims in the Application with the 
following Listing of Claims. 
LISTING OF CLAIMS: 

1. (Previously Presented) A method of monitoring an element in a computer 
network, said method comprising: 

monitoring a preselected variable relating to said element; 
defining a threshold for the monitored preselected variable; 
establishing a sliding window in time; 

repeatedly generating a time above threshold value, said time above threshold 
value being a measure of an amount of time during which the monitored variable 
exceeded the threshold during the sliding window of time, wherein the measure of the 
amount of time during which the monitored variable exceeded the threshold during the 
sliding window in time includes an aggregation of two or more noncontiguous time 
intervals during which the monitored variable exceeded the threshold during the sliding 
window in time; 

detecting when the time above threshold value exceeds a predefined_condition 
window value; and 

in response to detecting when the time above threshold value exceeds said 
condition window, generating an alarm. 

2. (Original) The method of claim 1 further comprising after generating an alarm, 
maintaining the alarm at least as long as the time above threshold value exceeds a 
clear window value. 

3. (Original) The method of claim 2 wherein said clear window value is equal to 
said condition window value. 
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4. (Original) The method of claim 3 further comprising: 

monitoring a plurality of variables relating to said element, said preselected 
variable being one of said plurality of variables; and 

for each of the plurality of monitored variables, defining a corresponding 
threshold for that other variable, wherein the time above threshold value is a measure 
of an amount of time during which any one or more of the monitored variables 
exceeded its corresponding threshold during the corresponding sliding window of time. 

5. (Original) The method of claim 1 wherein the step of defining the threshold for 
the preselected variable comprises: 

computing an average value for the preselected variable based on values obtained for 
the preselected variable over a corresponding prior period; 
defining an excursion amount; and 

setting the threshold equal to a sum of the average value plus the excursion 
amount. 

6. (Original) The method of claim 5 wherein the corresponding period of time is 
less than a day. 

7. (Original) The method of claim 6 wherein the corresponding period of time is a 
particular hour period of a day. 

8. (Original) The method of claim 6 wherein the step of computing the average 
comprises computing a mean value for the preselected variable using values obtained 
for that preselected variable for the same hour period of the same day of the week for a 
predetermined number of previous weeks. 

9. (Original) The method of claim 5 wherein the step of defining an excursion 
amount comprises: 

computing a standard deviation for the preselected variable based on values 
obtained for the preselected variable over a predetermined period of time; and 
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setting the excursion amount equal to K times the computed standard deviation, 
wherein K is a positive number. 

10. (Original) The method of claim 9 wherein the step of computing the standard 
deviation comprises computing the standard deviation using values obtained for that 
preselected variable for the same hour period of the same day of the week for a 
predetermined number of previous weeks. 

1 1 . (Original) The method of claim 2 wherein the step of defining the threshold for 
the preselected variable comprises: 

defining an excursion amount; and 

setting the threshold equal to H less the excursion amount, where H is a positive 
number. 

12. (Original) The method of claim 1 1 wherein the step of defining an excursion 
amount comprises: 

computing a standard deviation for the preselected variable based on values 
obtained for the preselected variable over a predetermined period of time; and 

setting the excursion amount equal to K times the computed standard deviation, 
wherein K is a positive number. 

13. (Previously Presented) A method of monitoring an element in a computer 
network, said method comprising: 

defining a profile for that element, said profile including a plurality of different 
alarm rules, each of said different alarm rules establishing an alarm test for a 
corresponding one or more variables; 

detecting when the alarm test for any one or more of the plurality of different 
alarm rules is met; 

repeatedly generating a time above threshold value, said time above threshold 
value being a measure of an amount of time during which at least one of the one or 
more alarm tests has been met during a preselected prior window of time, wherein the 
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measure of the amount of time during which at least one of the one or more alarm tests 
has been met during the preselected prior window of time includes an aggregation of 
two or more noncontiguous time intervals during which at least one of the one or more 
alarm tests has been met during a preselected prior window of time; 

detecting when the time above threshold value exceeds a predefined condition 
window value; and 

in response to detecting when the time above threshold value exceeds said 
condition window, generating an alarm. 

14. (Original) The method of claim 1 3 further comprising after generating an 
exception, maintaining that exception at least as long as the time above threshold value 
exceeds a clear window value. 

15. (Cancel) 

16. (Previously Presented) A computer program stored on a computer-readable 
medium for causing a computer system to perform the functions of: 

monitoring a preselected variable relating to an element of a computer network; 
defining a threshold for the monitored preselected variable; 
establishing a sliding window in time; 

repeatedly generating a time above threshold value, said time above threshold 
value being a measure of an amount of time during which the monitored variable 
exceeded the threshold during the sliding window of time, wherein the measure of the 
amount of time during which the monitored variable exceeded the threshold during the 
sliding window in time includes an aggregation of two or more noncontiguous time 
intervals during which the monitored variable exceeded the threshold during the sliding 
window in time; 

detecting when the time above threshold value exceeds a predefined condition 
window value; and 

in response to detecting when the time above threshold value exceeds said 
condition window, generating an alarm. 
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17. (Previously Presented) A computer program for monitoring an element in a 
computer network, said program stored on a computer-readable medium for causing a 
computer system to perform the functions of: 

defining a profile for that element, said profile including a plurality of different 
alarm rules, each of said different alarm rules establishing an alarm test for a 
corresponding one or more variables; 

detecting when the alarm test for any one or more of the plurality of different 
alarm rules is met; 

repeatedly generating a time above threshold value, said time above threshold 
value being a measure of an amount of time during which any one or more of the alarm 
tests has been met during a preselected prior window of time, wherein the measure of 
the amount of time during which any one or more of the alarm tests has been met 
during the preselected prior window of time includes an aggregation of two or more 
noncontiguous time intervals during which any one or more of the alarm tests has been 
met during the preselected prior window of time; 

detecting when the time above threshold value exceeds a predefined condition 
window value; and 

in response to detecting when the time above threshold value exceeds said 
condition window, generating an alarm. 

18. (Cancel) 
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